RHEL for Edge

Review the most notable changes to RHEL for Edge between RHEL 9 and RHEL 10.

Rust-based FIDO Device Onboard implementation is deprecated

In RHEL 10 for Edge, the Rust-based implementation of FIDO Device Onboard (FDO) (fdo-rs and fido-device-onboard) is deprecated.

For deploying automated device onboarding pipelines, migrate to the Go-based implementation (go-fdo).

The go-fdo packages replace the legacy fdo-rs packages with their equivalents:

  • go-fdo-server-owner replaces fdo-admin-cli.
  • go-fdo-client replaces fdo-client.
  • go-fdo-server-manufacturer replaces fdo-manufacturing-server.
  • go-fdo-server-owner replaces fdo-owner-cli.
  • go-fdo-server-owner replaces fdo-owner-onboarding-server.
  • go-fdo-server-rendezvous replaces fdo-rendezvous-server.
Rust-based and Go-based FDO implementations are not interoperable
The Rust-based and Go-based FIDO Device Onboard (FDO) implementations are not cross-compatible. A go-fdo client cannot onboard against a legacy fdo-rs server, and a legacy fdo-rs client cannot onboard against a go-fdo server.
Greenboot Bash implementation is deprecated

In RHEL 10, the Bash implementation of greenboot (greenboot-0.15.9) is deprecated and replaced by the Rust implementation (greenboot-rs).

  • Image mode for RHEL (bootc): Systems that use image mode transition to greenboot-rs automatically during standard bootc upgrade workflows without requiring manual configuration.
  • Package-based RHEL for Edge deployments: If you maintain custom health check scripts, you must test your existing scripts against greenboot-rs to ensure operational compatibility after you upgrade to RHEL 10.
Greenboot reimplementation
RHEL 10.2 includes greenboot-rs, a reimplementation of the greenboot health check framework. The new version improves maintainability and reliability while remaining compatible with existing health checks.
New FDO Implementation in RHEL 10.2
A new version of the FIDO Device Onboarding (FDO) protocol is available and fully supported. The go-fdo-client and go-fdo-server RPMs provide secure, automated, zero-touch provisioning for RHEL for Edge systems.
FDO RPMs and container images available as a Technology Preview
RHEL 10.2 continues to provide the original FIDO Device Onboarding (FDO) implementation as a Technology Preview.
RHEL for Edge now uses image mode for RHEL to create edge artifacts
Starting from RHEL 10, RHEL for Edge supports using image mode to build images, instead of using RHEL image builder.
You can now deploy image mode for RHEL systems by using FDO
Support for deploying an image mode for RHEL systems by using FDO the FIDO Device Onboarding (FDO) process to deliver the configuration to this system is now available.
The Ignition is no longer fully supported for RHEL for Edge images created with image mode for RHEL
The Ignition tool, used to inject the user configuration into the Simplified Installer, AMI, and VMDK RHEL for Edge images types at the early stage of the boot process, has been removed and has no replacement.
Migrating RHEL for Edge 9 systems image mode in RHEL 10 requires rebuilding the initramfs directories
RHEL for Edge systems using RHEL 9 that were installed by using a simplified-installer or a raw disk image have their root disk encrypted with LUKS that uses a null cipher. When migrating these systems to using image mode in RHEL 10, you must include specific clevis packages in the container image and regenerate the initramfs directories as part of the container image build process.